Admin rights?

Topic

New Reply

I was having a tussle with a file manager I use (Total Commander) trying to get folder rights and copies straight.

In describing my setup, I said that I was a member of the Admin group, and that therefore I shouldn’t have issues with accessing files or folders.

One of the board members then told me

It’s a newly security concept since Vista:

<cite>blogs.msdn wrote:</cite>Firstly, it’s worth a brief digression into the benefits of this feature.
Running as admin is a bad thing,…
…, running as a standard user can still be a somewhat painful proposition.
Windows Vista attempts to give you the benefits of both worlds
by allowing administrators to execute most processes in the context of a standard user
and only elevating the privileges on their user token by consent, …

https://blogs.msdn.microsoft.com/tims/2006/09/20/windows-vista-secret-4-disabling-uac/

So I came straight away to this the DB of all knowledgeable members and ideas for the best answer.

So, here’s the question:  Why in the world would Microsoft mix it up like that?  So I am in the Admin group, but NOT with Admin rights and access????

 

Chuck Billow

Reply | Quote

Replies

A member of the Admin group has Admin rights, but gets a UAC warning before performing any action which needs Admin rights (which is what that link is all about).

Reply | Quote

[Bundaburra]

It’s possible to run a program with just “normal user” rights, even if you are in the Admin group.  I find it useful to sign on as an administrator, but when I run certain programs, especially those which access the Internet, I want to be a normal user without Admin rights.  This can be achieved via a program called StripMyRights, which will run an application with reduced rights.  For example, if you are logged on as an Admin but want to run Firefox without Admin privileges, the command would be something like:

C:\…\StripMyRights.exe /L N  “C:\…..\Firefox.exe”.

It’s an old program from the XP days, but works with all Windows versions including Win 10.

Windows 10 Pro 64 bit 20H2

• This reply was modified 5 years, 7 months ago by Bundaburra.

1 user thanked author for this post.

wavy

Reply | Quote

You can use the ShellRunas utility from the most excellent Sysinternals suite. It only needs to be installed once, at which point you can right-click on a shortcut, select “Run as different user” from the context menu, then provide the desired credentials. I believe you can also create a ShellRunas shortcut to launch the program you want to run as another user. Take a look at the usage examples.

However, as a matter of principle, I always run as limited user in my day to day activities, and elevate to admin privileges as needed.

Reply | Quote

Admins do NOT have full access to all folders and files. This is set by the NTFS permissions and applies to users regardless of admin rights.

What you can do as an admin is change the permissions, but this is not recommended unless you know exactly what you what you are doing.

cheers, Paul

Reply | Quote

Hi Chuck, several have now reexplained what you have already learned.

“So, here’s the question: Why in the world would Microsoft mix it up like that? So I am in the Admin group, but NOT with Admin rights and access????”

Well, while some people do know what they are doing; Microsoft has found that they receive fewer calls for support when they default restrict access to areas that affect systems operations. There are methods to access nearly all these restricted areas. The preferred method may vary depending on what you wish to accomplish. This reduced load to fix broken systems is the direct answer to your valid question from frustration.

Have you already accomplished your task at hand? Is there a specific example you still need help with, or an experience you can share to illustrate what you found to work? We often enjoy learning new ways to do small tasks.

Reply | Quote

I run routinely as a Standard user.  I do not sign in as a member of the Administrators group unless I’m wanting to do something that gets a popup “You must me logged in as an Administrator to perform this action”.  I have UAC set to default.

I can say that if the default Administrator is enabled, there are a couple of things that account can do that a member of the Administrators group cannot, and it’s only a couple of things.  I have enabled and used it a time or two, then disabled it when I did what I wanted to do.

I have recently, however, discovered a utility that allows one to run as TrustedInstaller.  Talk about a way to ruin your cupcakes!  It’s one you do not want to use without a very recent drive image, because there isn’t much that one can’t do as TrustedInstaller.  One can edit the registry without needing to take ownership of any keys.

Always create a fresh drive image before making system changes/Windows updates; you may need to start over!

We all have our own reasons for doing the things that we do with our systems; we don't need anyone's approval, and we don't all have to do the same things.

We were all once "Average Users".

Computer Specs

Reply | Quote

I have recently, however, discovered a utility that allows one to run as TrustedInstaller.

Can you name and provide a download link for that utility? Some of us can be trusted with such power.

-- rc primak

Reply | Quote

“run as trustedinstaller” in google gives, for example:
https://www.ghacks.net/2016/08/13/powerrun-run-programs-as-trustedinstaller/
https://wj32.org/processhacker/forums/viewtopic.php?t=1932

1 user thanked author for this post.

rc primak

Reply | Quote

[rc primak]

Process Hacker looks difficult to set up and to use, and their forums do not make things easy.

However, this tool looks a bit easier, though you still have to understand what you are doing and why:

PowerRun v1.3 (Run with highest privileges)

https://www.sordum.org/9416/powerrun-v1-3-run-with-highest-privileges/

(I prefer direct links to the original vendors’ web sites.)

-- rc primak

• This reply was modified 5 years, 7 months ago by rc primak.

Reply | Quote

[bbearren]

rc primak wrote:

Can you name and provide a download link for that utility? Some of us can be trusted with such power.

The particulars are here.  I’ve used Process Hacker for a few years (it has improved considerably over the years), and it has proven quite trustworthy, and it is, indeed, quite powerful.  I use the portable version.

Always create a fresh drive image before making system changes/Windows updates; you may need to start over!

We all have our own reasons for doing the things that we do with our systems; we don't need anyone's approval, and we don't all have to do the same things.

We were all once "Average Users".

Computer Specs

• This reply was modified 5 years, 7 months ago by bbearren.

1 user thanked author for this post.

rc primak

Reply | Quote

I should look into this and see if it helps when and if I ever need the elevated privileges again.

-- rc primak

Reply | Quote